Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Android.HiddenAds.67.origin
Сетевая активность:
Подключается к:
- s####.####.com
- u####.####.com
- a####.####.net
- o####.####.com
- r####.####.com
- down####.####.net
- bina####.####.com
- 1####.####.253
- a####.####.com
Запросы HTTP GET:
- a####.####.net/v4/plugin/recommend?version=####&channel=####&language=####&t=####&aid=####&o1=####&gid=####
- a####.####.net/v3/message/show?lmTime=####&startWith=####
- bina####.####.com/Izapya/socialmedia/kidsgettingsmart.jpg
- a####.####.net/v4/plugin/transrecm?version=####&channel=####&language=####&t=####&aid=####&o1=####&gid=####
- a####.####.net/v4/bizplan/pkg
- a####.####.net/v4/user/boot?wl=####&bl=####&ol=####&rc=####&bn=####&bv=####&hw=####&at=####
- r####.####.com/easemob/server.json?sdk_version=####&app_key=####&file_version=####
- a####.####.net/v4/bizplan/show
- u####.####.com/setting/grobal_strategy?p=####&hp=####&l=####&c=####&prod=####&svn=####
- a####.####.net/v4/plugin/ad?version=####&channel=####&language=####&type=####
- a####.####.net/v3/plugin/vip?version=####&channel=####&language=####&t=####&aid=####&o1=####&gid=####
- a####.####.com/strategy/api/v1/rule/get?p=####&hp=####&l=####&c=####&prod=####&svn=####&sv=####&nv=####
- a####.####.com/v3/api/nativeads?&publisherid=####&slotid=####&lang=####×tamp=####&platform=####&osv=####&dpi=####&tzone=####&aid=####&gaid=####&o...
- a####.####.com/mediation/config?&publisher_id=####&slot_id=####&app_id=####&platform=####&aid=####&gaid=####&language=####&version_code=####&osv=####&...
- down####.####.net/update/KuaiYa_release_google.xml
- a####.####.net/v4/plugin/vs?version=####&channel=####&language=####&t=####&aid=####&o1=####&gid=####
- a####.####.net/v4/plugin/open
Запросы HTTP POST:
- a####.####.net/user/runLog/json
- 1####.####.253/dewmobile/kuaiya/devices
- a####.####.net/v4/plugin/stat
- o####.####.com/v2/check_config_update
- o####.####.com/v2/get_update_time
- a####.####.com/detail/getOfferListNew?enc=####
- a####.####.net/v2/message/stat
- a####.####.net/v3/action
- a####.####.net/v3/users
- s####.####.com/cgi-bin-py/ad_sdk.cgi?ty=####&enc=####&bt=####
- a####.####.com/app_logs
Изменения в файловой системе:
Создает следующие файлы:
- /data/data/####/shared_prefs/server_info.xml
- /data/data/####/data.log
- /data/data/####/shared_prefs/event_flow.xml.bak
- /data/data/####/databases/cc.db-journal
- /data/data/####/shared_prefs/apsad.xml.bak
- /sdcard/Android/data/####/cache/volley/299738453757072334
- /sdcard/Android/data/####/cache/volley/-1925975135135814254
- /data/data/####/databases/cc.db
- /data/data/####/cache/webviewCacheChromium/data_3
- /data/data/####/cache/webviewCacheChromium/data_2
- /data/data/####/cache/webviewCacheChromium/data_1
- /data/data/####/cache/webviewCacheChromium/data_0
- /data/data/####/shared_prefs/device_id2.xml.xml
- /data/data/####/databases/webviewCookiesChromium.db-journal
- /data/data/####/cache/lastImage.cache
- /data/data/####/shared_prefs/com.pingstart.adsdk.preference.xml.bak
- /sdcard/Android/data/####/cache/volley/-1575900550772655395
- /data/data/####/databases/transfer20.db-journal
- /data/data/####/shared_prefs/onlineconfig_agent_online_setting_####.xml
- /data/data/####/files/.umeng/exchangeIdentity.json
- /sdcard/Android/data/####/cache/volley/-1414830958-2108495103
- /data/data/####/shared_prefs/z_rules.xml
- /data/data/####/shared_prefs/multidex.version.xml
- /sdcard/zapya/.cache/.i
- /data/data/####/files/exid.dat
- /data/data/####/databases/webview.db-journal
- /data/data/####/shared_prefs/aps.xml.bak
- /sdcard/Android/.i
- /data/data/####/cache/_storage_emulated_0scanresult3.cache
- /data/data/####/shared_prefs/z_hw_list.xml
- /data/data/####/cache/webviewCacheChromium/index
- /data/data/####/cache/lastAudio.cache
- /sdcard/Android/data/####/cache/volley/299738453-1157354448
- /sdcard/Android/data/####/cache/volley/807064876-1948062404
- /data/data/####/cache/webviewCacheChromium/f_00000c
- /data/data/####/cache/webviewCacheChromium/f_00000b
- /data/data/####/databases/hide.db-journal
- /sdcard/Android/data/####/cache/volley/-1569660365-1734728509
- /sdcard/.androidsystem/.files/gads.db
- /sdcard/Android/data/####/cache/volley/1676344870-1960167081
- /data/data/####/files/google.db
- /sdcard/Android/data/####/cache/volley/-1925975135-235940018
- /sdcard/_zy_1485418693115_zy
- /data/data/####/shared_prefs/apscomm.xml
- /data/data/####/shared_prefs/at_lottery.xml
- /data/data/####/shared_prefs/immsg.xml
- /data/data/####/cache/webviewCacheChromium/f_000009
- /data/data/####/cache/webviewCacheChromium/f_000008
- /sdcard/Android/data/####/cache/volley/-18829389881140617064
- /data/data/####/cache/webviewCacheChromium/f_000001
- /data/data/####/shared_prefs/DewMobileApi.xml
- /data/data/####/cache/webviewCacheChromium/f_000003
- /data/data/####/cache/webviewCacheChromium/f_000002
- /data/data/####/cache/webviewCacheChromium/f_000005
- /data/data/####/cache/webviewCacheChromium/f_000004
- /data/data/####/cache/webviewCacheChromium/f_000007
- /data/data/####/cache/webviewCacheChromium/f_000006
- /data/data/####/shared_prefs/app_banner_new.xml
- /data/data/####/files/umeng_it.cache
- /sdcard/Android/data/####/cache/volley/1624021654830132818
- /data/data/####/databases/job.db-journal
- /sdcard/zapya/doodle/.nomedia
- /data/data/####/shared_prefs/aps.xml
- /data/data/####/shared_prefs/AdsBusiness-data.xml
- /sdcard/Android/data/####/cache/volley/16763448701631996050
- /data/data/####/shared_prefs/apsad.xml
- /data/data/####/databases/ua.db
- /data/data/####/shared_prefs/z_wblist.xml
- /data/data/####/shared_prefs/event_flow.xml
- /data/data/####/shared_prefs/umeng_feedback_conversations.xml
- /data/data/####/files/config.json
- /data/data/####/shared_prefs/umeng_general_config.xml
- /sdcard/Android/data/####/cache/volley/1624021654830132820
- /data/data/####/shared_prefs/z_wblist.xml.bak
- /sdcard/Android/data/.nomedia
- /data/data/####/shared_prefs/AdsBusiness-data.xml.bak
- /data/data/####/cache/webviewCacheChromium/f_00000a
- /data/data/####/databases/download.db-journal
- /data/data/####/shared_prefs/####_preferences.xml
- /sdcard/Android/data/####/cache/volley/-1569660365-2116477840
- /data/data/####/shared_prefs/z_olparams.xml
- /sdcard/Android/data/####/cache/volley/19274568921761104758
- /data/data/####/databases/hide.db
- /sdcard/.z
- /data/data/####/shared_prefs/appsflyer-data.xml
- /data/data/####/shared_prefs/com.pingstart.adsdk.preference.xml
- /data/data/####/shared_prefs/server_info.xml.bak
- /data/data/####/cache/lastEbook.cache
- /sdcard/Android/data/####/cache/volley/-1414830958-1066056720
- /data/data/####/shared_prefs/device_id.xml.xml
- /data/data/####/databases/ua.db-journal
- /sdcard/Android/data/####/cache/volley/-1664800851099232487
- /sdcard/Android/data/####/cache/volley/-17238211321283064974
- /data/data/####/files/server.json
- /data/data/####/files/.imprint
- /data/data/####/databases/plugin20.db-journal
- /data/data/####/shared_prefs/localUser.xml
- /data/data/####/app_mbj/dex/classes.zip
- /data/data/####/cache/lastApps.cache
- /data/data/####/cache/localApp.cache
- /sdcard/baidu/AndroidStore/http_cache/journal.tmp
- /data/data/####/shared_prefs/umeng_feedback_user_info.xml
- /sdcard/baidu/.cuid
- /data/data/####/databases/search.db-journal
- /data/data/####/shared_prefs/####_preferences.xml.bak
- /data/data/####/shared_prefs/umeng_general_config.xml.bak
- /data/data/####/shared_prefs/appsflyer-data.xml.bak
- /data/data/####/shared_prefs/z_time.xml
Другие:
Может автоматически отправлять СМС-сообщения.
